The present invention is of a system, a device and method for rapid packet filtering on a packet-switched network, and in particular, to such a system, a device and method in which the efficiency of packet filtration is increased by session-based filtering.
Connectivity and security are two conflicting objectives in the computing environment of most organizations. The typical modern computing system is built around network communications, supplying transparent access to a multitude of services. The global availability of these services is perhaps the single most important feature of modern computing solutions. Demand for connectivity comes both from within organizations and from outside them.
Protecting network services from unauthorized usage is of paramount importance to any organization. As the need for increased security grows, the means of controlling access to network resources has become an administrative priority. In order to save cost and maintain productivity, access control must be simple to configure and transparent to users and applications. The minimization of setup costs and down time are also important factors.
Packet filtering is a method which allows connectivity yet provides security by controlling the traffic being passed, thus preventing illegal communication attempts, both within single networks and between connected networks.
U.S. Pat. Nos. 5,835,726 (filed on Jun. 17, 1996) and U.S. Pat. No. 5,606,668 (filed on Dec. 15, 1993), both of which are hereby incorporated by reference as if fully disclosed herein, describe methods for providing network security by controlling the inbound and outbound data packet flow in a computer network. The flow of packets is controlled through packet filtering, performed according to a user-generated rule base which is then converted into a set of filter language instructions. Each rule in the rule base includes a source, destination, service, whether to accept or reject the packet and whether to log, encrypt and/or authenticate the event. The set of filter language instructions are installed and execute on inspection engines which are placed on computers acting as firewalls. The inspection engines perform stateful inspection in order to determine whether a packet should be permitted to enter through the firewall. The firewalls are positioned in the computer network such that all traffic to and from the network to be protected is forced to pass through the firewall. Thus, packets are filtered as they flow into and out of the network in accordance with the rules comprising the rule base.
According to these references, the inspection engine acts as a virtual packet filtering machine which determines on a packet by packet basis whether to reject or accept a packet. If a packet is rejected, it is dropped. If it is accepted, the packet may then be modified. Modification may include encryption, decryption, signature generation, signature verification or address translation. All modifications are performed in accordance with the contents of the rule base.
Unfortunately, one drawback of the disclosed method is that a large computational burden is placed upon the computer which operates the firewall. The previously disclosed processes of packet filtration require each packet to be separately analyzed, with many different comparisons to the set of rules according to which packet entry through the firewall is determined. However, once a session, or connection between two nodes which is established through the firewall, has been validated as permitted, then in most cases, further intensive analysis may not be necessary. Thus, reducing or even eliminating the requirement for continued analysis of packets from a permitted connection would significantly reduce the computational burden imposed by a firewall and accelerate the process of packet filtering, while still maintaining the security of the protected system.
There is thus a need for, and it would be useful to have, a system, a device and a method for rapid packet filtration according to the connection from which a packet is received, such that if a packet is received from a permitted connection, the requirement for complete packet analysis is reduced or even eliminated, while the ability to rapidly and efficiently modify packets is still maintained, optionally through hardware acceleration of the modification process.
The present invention is of a system, a device, and a method for accelerating packet filtration on a packet-switched network, preferably an IP network, by supplementing a firewall with a pre-filtering module. The pre-filtering module performs a limited set of actions with regard to the packets, according to whether the packets are received from a connection which has been previously permitted by the firewall. If the packets are received from such a permitted connection, then the pre-filtering module forwards the packets to their destination, optionally performing one or more actions on the packets. Otherwise, the packets are forwarded to the firewall for handling. Preferably, once the firewall has transferred responsibility for the connection to the pre-filtering module, or xe2x80x9coff-loadedxe2x80x9d the connection, the firewall does not receive further packets from this connection until a timeout occurs for the connection, or a packet is received with a particular session-control field value which indicates that the session is finished, such that the connection is closed.
For example, for the preferred implementation of the present invention with IP networks, such a session-control field value is a FIN/RST flag which is set for the packet.
One advantage of reducing or even eliminating the amount of analysis which is required for packets from a permitted connection is that the firewall can optionally be supplemented by hardware acceleration. Such hardware acceleration has the advantage of being much more rapid than software-based packet processing, and can therefore significantly increase the efficiency of the firewall system. In addition, hardware acceleration of the modification process can maintain the ability to rapidly and efficiently modify packets, since the modification process requires less xe2x80x9cintelligencexe2x80x9d for modifying the packets but faster processing, while the opposite characteristics are true for the process of packet analysis. Thus, optionally and preferably, the pre-filtering module is implemented as hardware.
According to the present invention, there is provided a system for accelerated packet filtering, the system comprising: (a) a source node for transmitting a packet; (b) a destination node for receiving the packet; (c) a firewall interposed between the source node and the destination node for performing packet filtering according to at least one rule; and (d) a pre-filtering module being in communication with the firewall, for receiving at least one instruction from the firewall and for receiving the packet before the firewall, such that if the packet is permitted according to the at least one instruction, the pre-filtering module handles the packet, and alternatively the pre-filtering module forwards the packet to the firewall for handling.
According to another embodiment of the present invention, there is provided a system for accelerated filtering of a packet on a network, the system comprising: (a) a firewall located on the network for performing packet filtering on the packet according to at least one rule; and (b) a pre-filtering module located on the network and in communication with the firewall, for receiving at least one instruction from the firewall, the at least one instruction determining a simple comparison, and for receiving a packet transmitted on the network before the firewall, such that if the packet is permitted according to the simple comparison, the pre-filtering module at least transmits the packet on the network.
According to yet another embodiment of the present invention, there is provided, for use in a system for accelerated packet filtration, the system featuring a network for transmitting a packet and a firewall on the network for filtering the packet, a device for receiving the packet before the firewall, the device comprising: (a) a memory for storing at least one instruction for analyzing at least one parameter of the packet from the firewall, the at least one instruction including the at least one parameter for identifying the packet; and (b) a classification engine for analyzing at least a portion of the packet and for comparing the at least a portion of the packet to the at least one parameter according to the at least one instruction.
According to still another embodiment of the present invention, there is provided a method for accelerated packet filtering on a network in conjunction with a firewall, the method comprising the steps of: (a) providing a pre-filtering module for receiving a packet before the firewall; (b) receiving the packet by the pre-filtering module; (c) determining whether the packet is permitted; and (d) if the packet is permitted, handling the packet by the pre-filtering module.
Hereinafter, the term xe2x80x9cnetworkxe2x80x9d includes a connection between any two or more computational devices which permits the transmission of data.
Hereinafter, the term xe2x80x9ccomputational devicexe2x80x9d includes, but is not limited to, personal computers (PC) having an operating system such as Windows(trademark), or Linux; Macintosh(trademark) computers; computers having JAVA(trademark)-OS as the operating system; workstations such as the computers of Sun Microsystems(trademark) and Silicon Graphics(trademark), and other computers having some version of the UNIX operating system such as AIX(trademark) or SOLARIS(trademark) of Sun Microsystems(trademark); any other known and available operating system; any type of computer; any device which can be connected to a packet switched network and which has an operating system, including but not limited to VxWorks(trademark) and PSOS(trademark); or any device which can be so connected to a packet switched network, which is capable of transmitting and receiving packets, and which has at least a data processor, such as a network processor for example, including but not limited to, a bridge, a switch or a router. Hereinafter, the term xe2x80x9cWindows(trademark)xe2x80x9d includes but is not limited to Windows NT(trademark), Windows98(trademark), Windows2000(trademark), Windows CE(trademark) and any upgraded versions of these operating systems by Microsoft Corp. (USA).
The method of the present invention could be described as a series of steps performed by a data processor, and as such could optionally be implemented as software, hardware or firmware, or a combination thereof. For the present invention, a software application could be written in substantially any suitable programming language, which could easily be selected by one of ordinary skill in the art. The programming language chosen should be compatible with the computational device according to which the software application is executed. Examples of suitable programming languages include, but are not limited to, C, C++ and Java.